

<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
<head>
  <meta charset="utf-8">
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
  <title>Quickstart &mdash; vt-py  documentation</title>
  

  
  
  
  

  
  <script type="text/javascript" src="_static/js/modernizr.min.js"></script>
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
        <script type="text/javascript" src="_static/jquery.js"></script>
        <script type="text/javascript" src="_static/underscore.js"></script>
        <script type="text/javascript" src="_static/doctools.js"></script>
        <script type="text/javascript" src="_static/language_data.js"></script>
    
    <script type="text/javascript" src="_static/js/theme.js"></script>

    

  
  <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
  <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
    <link rel="next" title="API reference" href="apireference.html" />
    <link rel="prev" title="Overview" href="overview.html" /> 
</head>

<body class="wy-body-for-nav">

   
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >
          

          
            <a href="index.html" class="icon icon-home"> vt-py
          

          
          </a>

          
            
            
          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <p class="caption"><span class="caption-text">Contents:</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="howtoinstall.html">How to install</a></li>
<li class="toctree-l1"><a class="reference internal" href="overview.html">Overview</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Quickstart</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#get-information-about-a-file">Get information about a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#get-information-about-an-url">Get information about an URL</a></li>
<li class="toctree-l2"><a class="reference internal" href="#scan-a-file">Scan a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#scan-an-url">Scan an URL</a></li>
<li class="toctree-l2"><a class="reference internal" href="#download-a-file">Download a file</a></li>
<li class="toctree-l2"><a class="reference internal" href="#start-and-abort-a-retrohunt-job">Start and abort a Retrohunt job</a></li>
<li class="toctree-l2"><a class="reference internal" href="#create-a-livehunt-ruleset">Create a LiveHunt ruleset</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="apireference.html">API reference</a></li>
</ul>

            
          
        </div>
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="index.html">vt-py</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="index.html">Docs</a> &raquo;</li>
        
      <li>Quickstart</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
            
            <a href="_sources/quickstart.rst.txt" rel="nofollow"> View page source</a>
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <div class="section" id="quickstart">
<h1>Quickstart<a class="headerlink" href="#quickstart" title="Permalink to this headline">¶</a></h1>
<div class="section" id="get-information-about-a-file">
<h2>Get information about a file<a class="headerlink" href="#get-information-about-a-file" title="Permalink to this headline">¶</a></h2>
<p>Start by importing the <cite>vt</cite> module:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">vt</span>
</pre></div>
</div>
<p>Create a client, replace <cite>&lt;apikey&gt;</cite> with your actual VirusTotal API key:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">client</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Client</span><span class="p">(</span><span class="s2">&quot;&lt;apikey&gt;&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Ask for the file you are interested in, you can replace the hash in the example
with some other SHA-256, SHA-1 or MD5:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/files/44d88612fea8a8f36de82e1278abb02f&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Now <cite>file</cite> is an instance of <a class="reference internal" href="api/object.html#vt.Object" title="vt.Object"><code class="xref py py-class docutils literal notranslate"><span class="pre">vt.Object</span></code></a> that contains information
about the requested file. This object have the attributes returned in the
API response which are listed in the <a class="reference external" href="https://developers.virustotal.com/v3.0/reference#files">VirusTotal API v3 documentation</a>. Some examples:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">size</span>
<span class="go">68</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">sha256</span>
<span class="go">&#39;275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f&#39;</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">type_tag</span>
<span class="go">&#39;text&#39;</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">last_analysis_stats</span>
<span class="go">{&#39;failure&#39;: 0, &#39;harmless&#39;: 0, &#39;malicious&#39;: 62, &#39;suspicious&#39;: 0, &#39;timeout&#39;: 0, &#39;type-unsupported&#39;: 9, &#39;undetected&#39;: 2}</span>
</pre></div>
</div>
<p>Alternatively, you can use the <code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Object.get()</span></code> method for retrieving
object’s attributes:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;size&quot;</span><span class="p">)</span>
<span class="go">68</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">file</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="s2">&quot;type_tag&quot;</span><span class="p">)</span>
<span class="go">&#39;text&#39;</span>
</pre></div>
</div>
<p>This method is useful for those attributes that are optional and do not appear
in all files. For example, a Portable Executable (PE) file won’t have the <cite>pdf_info</cite>
attribute, and PDF document won’t have the <cite>pe_info</cite> attribute. This means that
<cite>file.pe_info</cite> will fail for PDF files but with <cite>file.get(“pe_info”)</cite> you are
on the safe side, as it will return <cite>None</cite> if the <cite>pe_info</cite> attribute is not
present.</p>
</div>
<div class="section" id="get-information-about-an-url">
<h2>Get information about an URL<a class="headerlink" href="#get-information-about-an-url" title="Permalink to this headline">¶</a></h2>
<p>Create a client as explained in the previous section and ask for the desired
URL as follows:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url_id</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">url_id</span><span class="p">(</span><span class="s2">&quot;http://www.virustotal.com&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">url</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/urls/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">url_id</span><span class="p">)</span>
</pre></div>
</div>
<p>In this case the code is not as straightforward as it was for getting a file.
While retrieving a file any of its hashes can be used as the file identifier,
but with URLs is a bit more complicated. You must use <a class="reference internal" href="api/utils.html#vt.url_id" title="vt.url_id"><code class="xref py py-func docutils literal notranslate"><span class="pre">vt.url_id()</span></code></a> for
generating the appropriate identifier. You can find more information about why
this is necessary in:
<a class="reference external" href="https://developers.virustotal.com/v3.0/reference#section-url-identifiers">https://developers.virustotal.com/v3.0/reference#section-url-identifiers</a>.</p>
<p>Also notice how we are using a placeholder <cite>{}</cite> in the path. The placeholder
will be replaced with the value of <cite>url_id</cite>. This works exactly like Python’s
<a class="reference external" href="https://pyformat.info/">new-style string formatting</a> using the <cite>.format()</cite>
function. This other code is equivalent:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/urls/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">url_id</span><span class="p">))</span>
</pre></div>
</div>
<p>The returned object contains the URL attributes. Some examples:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span><span class="o">.</span><span class="n">times_submitted</span>
<span class="go">213730</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">url</span><span class="o">.</span><span class="n">last_analysis_stats</span>
<span class="go">{&#39;harmless&#39;: 61, &#39;malicious&#39;: 0, &#39;suspicious&#39;: 1, &#39;timeout&#39;: 0, &#39;undetected&#39;: 8}</span>
</pre></div>
</div>
</div>
<div class="section" id="scan-a-file">
<h2>Scan a file<a class="headerlink" href="#scan-a-file" title="Permalink to this headline">¶</a></h2>
<p>Before scanning a file is highly recommended that you look up for it as
described in <a class="reference external" href="#get-information-about-a-file">Get information about a file</a>.
If the file already exists and the latest analysis is fresh enough, you can
use that instead of scanning the file again. If not, you can scan it with:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/file&quot;</span><span class="p">,</span> <span class="s2">&quot;rb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_file</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
</pre></div>
</div>
<p>When <a class="reference internal" href="api/client.html#vt.Client.scan_file" title="vt.Client.scan_file"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code></a> returns the analysis is not completed yet,
the object returned only has the analysis ID but not attributes. In order to
track the status of the analysis you must ask for the analysis object until
it’s status is <cite>completed</cite>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/analyses/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">analysis</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="nb">print</span><span class="p">(</span><span class="n">analysis</span><span class="o">.</span><span class="n">status</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="k">if</span> <span class="n">analysis</span><span class="o">.</span><span class="n">status</span> <span class="o">==</span> <span class="s2">&quot;completed&quot;</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>     <span class="k">break</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">30</span><span class="p">)</span>
</pre></div>
</div>
<p>Alternatively you can use the <cite>wait_for_completion</cite> argument:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/file&quot;</span><span class="p">,</span> <span class="s2">&quot;rb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_file</span><span class="p">(</span><span class="n">f</span><span class="p">,</span> <span class="n">wait_for_completion</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
</pre></div>
</div>
<p>When <cite>wait_for_completion</cite> is True <a class="reference internal" href="api/client.html#vt.Client.scan_file" title="vt.Client.scan_file"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code></a> doesn’t return
until the analysis has been completed.</p>
</div>
<div class="section" id="scan-an-url">
<h2>Scan an URL<a class="headerlink" href="#scan-an-url" title="Permalink to this headline">¶</a></h2>
<p>Scanning a URL is very similar to <a class="reference external" href="scan-a-file">scanning a file</a>, you just
need to use <a class="reference internal" href="api/client.html#vt.Client.scan_url" title="vt.Client.scan_url"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_url()</span></code></a> instead of <a class="reference internal" href="api/client.html#vt.Client.scan_file" title="vt.Client.scan_file"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.scan_file()</span></code></a>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">analysis</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">scan_url</span><span class="p">(</span><span class="s1">&#39;https://somedomain.com/foo/bar&#39;</span><span class="p">)</span>
</pre></div>
</div>
</div>
<div class="section" id="download-a-file">
<h2>Download a file<a class="headerlink" href="#download-a-file" title="Permalink to this headline">¶</a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Downloading a file it’s very simple, you only need to provide the hash and a
file-like object where the file’s content will be written to. The target file
must be opened in <cite>“wb”</cite> mode:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s2">&quot;/path/to/target_file&quot;</span><span class="p">,</span> <span class="s2">&quot;wb&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
<span class="gp">&gt;&gt;&gt; </span>  <span class="n">client</span><span class="o">.</span><span class="n">download_file</span><span class="p">(</span><span class="s2">&quot;44d88612fea8a8f36de82e1278abb02f&quot;</span><span class="p">,</span> <span class="n">f</span><span class="p">)</span>
</pre></div>
</div>
</div>
<div class="section" id="start-and-abort-a-retrohunt-job">
<h2>Start and abort a Retrohunt job<a class="headerlink" href="#start-and-abort-a-retrohunt-job" title="Permalink to this headline">¶</a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Create an empty object of type <cite>retrohunt_job</cite> and set its <cite>rules</cite> attribute:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Object</span><span class="p">(</span><span class="s2">&quot;retrohunt_job&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">rules</span> <span class="o">=</span> <span class="s2">&quot;rule test { condition:false }&quot;</span>
</pre></div>
</div>
<p>Post the object to the <cite>/intelligence/retrohunt_jobs</cite> collection:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs&quot;</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">job</span><span class="p">)</span>
</pre></div>
</div>
<p>Notice that <cite>job</cite> has been replaced with the value returned by
<a class="reference internal" href="api/client.html#vt.Client.post_object" title="vt.Client.post_object"><code class="xref py py-func docutils literal notranslate"><span class="pre">vt.Client.post_object()</span></code></a>, so now <cite>job</cite> has an ID and additional
attributes.</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">id</span>
<span class="go">&#39;username-123456789&#39;</span>
</pre></div>
</div>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">status</span>
<span class="go">&#39;starting&#39;</span>
</pre></div>
</div>
<p>With the object identifier you can ask for the job again a see it making
progress. Wait for a few seconds and do:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">job</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
</pre></div>
</div>
<p>The job status should have changed to <cite>running</cite>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">status</span>
<span class="go">&#39;running&#39;</span>
</pre></div>
</div>
<p>And the progress attribute should show the completion percentage:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">job</span><span class="o">.</span><span class="n">progress</span>
<span class="go">1.4145595</span>
</pre></div>
</div>
<p>Let’s abort the job:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post</span><span class="p">(</span><span class="s2">&quot;/intelligence/retrohunt_jobs/</span><span class="si">{}</span><span class="s2">/abort&quot;</span><span class="p">,</span> <span class="n">job</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">response</span><span class="o">.</span><span class="n">status</span>
<span class="go">200</span>
</pre></div>
</div>
<p>Here we are using <a class="reference internal" href="api/client.html#vt.Client.post" title="vt.Client.post"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post()</span></code></a> instead of <a class="reference internal" href="api/client.html#vt.Client.post_object" title="vt.Client.post_object"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post_object()</span></code></a>,
this is because the <a class="reference external" href="https://developers.virustotal.com/v3.0/reference#abort-retrohunt-job">/intelligence/retrohunt_jobs/{id}/abort</a>
endpoint doesn’t expect an object, just a POST request with an empty body. The
result from <a class="reference internal" href="api/client.html#vt.Client.post" title="vt.Client.post"><code class="xref py py-meth docutils literal notranslate"><span class="pre">vt.Client.post()</span></code></a> is a <a class="reference internal" href="api/client.html#vt.ClientResponse" title="vt.ClientResponse"><code class="xref py py-class docutils literal notranslate"><span class="pre">vt.ClientResponse</span></code></a> instance.</p>
</div>
<div class="section" id="create-a-livehunt-ruleset">
<h2>Create a LiveHunt ruleset<a class="headerlink" href="#create-a-livehunt-ruleset" title="Permalink to this headline">¶</a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This feature is available only for premium users.</p>
</div>
<p>Create an empty object of type <cite>hunting_ruleset</cite> and set its <cite>name</cite> and
<cite>rules</cite> attributes:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">vt</span><span class="o">.</span><span class="n">Object</span><span class="p">(</span><span class="s2">&quot;hunting_ruleset&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;My test ruleset&quot;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">rules</span> <span class="o">=</span> <span class="s2">&quot;rule test { condition:false }&quot;</span>
</pre></div>
</div>
<p>Post the object to the <cite>/intelligence/hunting_rulesets</cite> collection:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">post_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/hunting_rulesets&quot;</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">rs</span><span class="p">)</span>
</pre></div>
</div>
<p>Because we didn’t set the <cite>enabled</cite> attribute while creating the ruleset, it
was created with <cite>enabled=False</cite> by default:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span>
<span class="go">False</span>
</pre></div>
</div>
<p>Let’s enable the ruleset:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">patch_object</span><span class="p">(</span><span class="s2">&quot;/intelligence/hunting_rulesets/</span><span class="si">{}</span><span class="s2">&quot;</span><span class="p">,</span> <span class="n">rs</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">obj</span><span class="o">=</span><span class="n">rs</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">rs</span><span class="o">.</span><span class="n">enabled</span>
<span class="go">True</span>
</pre></div>
</div>
</div>
</div>


           </div>
           
          </div>
          <footer>
  
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
      
        <a href="apireference.html" class="btn btn-neutral float-right" title="API reference" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
      
      
        <a href="overview.html" class="btn btn-neutral float-left" title="Overview" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
      
    </div>
  

  <hr/>

  <div role="contentinfo">
    <p>
        &copy; Copyright 2019, VirusTotal

    </p>
  </div>
  Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/rtfd/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>. 

</footer>

        </div>
      </div>

    </section>

  </div>
  


  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>